Privacy policy

Dugga AB (“Dugga”, “we”, “us”) provides Dugga Digital Assessment (the “Service”), a web-based platform for creating and conducting tests, exams and assignments, both in the classroom and remotely. This Privacy Policy explains how we process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection legislation.

We have two roles. When a school, college, university or other educational institution (“School”) uses the Service, the School is the controller and Dugga processes personal data on its behalf as a processor (section 2). For our own website, communication and the technical operation of the Service, Dugga is the controller (section 3). For questions about how your School processes your personal data, please contact your School.

Data we process

Depending on your role (student, teacher, administrator, study administrator or exam guard), we process your name, email address, class, School and account information such as role, login events and activity in the Service. For students, this includes answers, completed assessments, feedback and grades. For teachers, this includes course and class information and the assessments they have carried out. In some cases, the School may also choose to register a personal identity number or a photo, but this is not required to use the Service.

How we receive it

We receive personal data from the School and from the login and learning platforms it uses, such as Microsoft 365 and Teams (via Microsoft Graph and School Data Sync) or Google Workspace, including through single sign-on.

Purpose, legal basis and retention

The School decides the purposes, the legal basis and how long personal data is kept, and we only process personal data on the School’s documented instructions under our Data Processing Agreement. When the agreement ends, personal data is deleted within 90 days, unless the School has decided otherwise.

Optional services

If a School activates optional services, additional processing may take place. This is governed by our agreement with that School, and the School informs its users accordingly.

AI Exam Engine

Our AI Exam Engine helps teachers generate exam questions. It does not process personal data, and the teacher reviews and approves all questions before they are used.

Log data

When you use our website or the Service, we automatically log technical data such as IP address, device and browser information and a client hash identifying the device. We use it to keep the Service secure and working, and to prevent misuse, based on our legitimate interest in maintaining IT security.

Communication and support

When you contact us by email, phone or through our website, we process your contact details (name, email address, phone number and School) to handle your request, based on our legitimate interest in communicating with and supporting you and your School.

Improving the Service

We use aggregated or pseudonymised usage data to develop and improve the Service, based on our legitimate interest.

Cookies

Our website and the Service use cookies that are necessary for them to work. Analytics cookies are only used on our public website, not in the Service, and only with your consent. Read more in our cookie policy at https://dugga.com/data.

Newsletter, testimonials and social media

If you subscribe to our newsletter, provide a testimonial or use social media features on our website, we process the data you provide for that purpose, and you can unsubscribe or withdraw your consent at any time.

Retention

Data processed as controller is kept for no longer than necessary, and for a maximum of 90 days after the termination of the contract. Communication data is kept for as long as needed to handle your request.

Many of our users are children. We process their personal data only as instructed by their School, and we never sell it or use it for advertising or marketing profiling.

Personal data in the Service is stored in Microsoft Azure data centres in the Netherlands, Ireland and Sweden, provided by Microsoft Netherlands, Microsoft Ireland and Microsoft Sweden.

Some of the service providers that support the operation of the Service, for example with security, monitoring and support, belong to groups based outside the EU/EEA, mainly in the United States. Where personal data is transferred to or accessed from outside the EU/EEA, we ensure appropriate safeguards, such as the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

We never sell or lease your personal data. We only share it with:

We protect personal data with appropriate technical and organisational measures, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256), single sign-on, role-based access control, access on a need-to-know basis, confidentiality obligations and regular data protection training for staff. Our information security management is aligned with ISO/IEC 27001 and is reviewed through annual internal audits. In the event of a personal data breach, we act in accordance with applicable law and, where we act as processor, notify the School without undue delay and no later than within 24 hours.

Under the GDPR, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to data portability. For personal data that your School is responsible for, please contact your School, and we will assist it in handling your request. For processing where Dugga is the controller, contact us using the details below.

You also have the right to lodge a complaint with the data protection authority in your country, or with the Swedish Authority for Privacy Protection (IMY), www.imy.se.

If you have questions about this Privacy Policy or our processing of personal data, contact us at privacy@dugga.com. You can also contact our Data Protection Officer at dpo@dugga.com.

Dugga AB, Sankt Eriksgatan 58, 112 34 Stockholm, Sweden, company registration number 559006-5198